The Elysia JavaScript framework contains a vulnerability in the t.String({ format: 'url' }) validator that leads to a Regular Expression Denial of Service. When an attacker repeats a partial URL pattern consisting of the protocol and hostname in a request, the underlying regex consumes excessive CPU resources, causing request processing to stall and the service to become unavailable. This flaw is classified as CWE‑1333, representing a time‑based denial of service attack.

The vulnerability affects the Elysia framework (elysiajs:elysia) running on Node.js. All releases prior to version 1.4.26 are susceptible, as the issue is confined to the url format validation logic used for request validation, type inference, OpenAPI documentation, and client‑server communication.

The severity rating of 7.5 indicates high potential damage if exploited, while the probability of exploitation is estimated to be below one percent. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation is possible by sending crafted URLs to any exposed API endpoint that uses the vulnerable validator; it is inferred that such an attack would not require special privileges and would be a remote denial‑of‑service attack, but this is not explicitly stated in the CVE description.